chore: upgrade cluster dependencies

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v4.3.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
@@ -26,6 +26,6 @@ repos:
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/stackrox/kube-linter
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: kube-linter

bootstrap/argocd-config.yaml

@@ -69,15 +69,15 @@ spec:
     initContainers:
       # Use alpine to download and install KSOPS binaries
       - name: install-ksops
-        image: docker.io/alpine:3.21
+        image: docker.io/alpine:3.23
         command: ["/bin/sh", "-c"]
         args:
           - |
             set -e
-            echo "Downloading kustomize v5.8.0..."
-            wget -qO- https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.8.0/kustomize_v5.8.0_linux_amd64.tar.gz | tar xz -C /custom-tools
-            echo "Downloading KSOPS v4.4.0..."
-            wget -qO- https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.4.0/ksops_4.4.0_Linux_x86_64.tar.gz | tar xz -C /custom-tools
+            echo "Downloading kustomize v5.8.1..."
+            wget -qO- https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.8.1/kustomize_v5.8.1_linux_amd64.tar.gz | tar xz -C /custom-tools
+            echo "Downloading KSOPS v4.5.1..."
+            wget -qO- https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.5.1/ksops_4.5.1_Linux_x86_64.tar.gz | tar xz -C /custom-tools
             chmod +x /custom-tools/kustomize /custom-tools/ksops
             echo "Done."
         volumeMounts:

operators/arc/arcsystem.yaml

@@ -34,7 +34,7 @@ spec:
   source:
     chart: gha-runner-scale-set-controller
     repoURL: ghcr.io/actions/actions-runner-controller-charts
-    targetRevision: 0.13.1
+    targetRevision: 0.14.2
     helm:
       releaseName: arc
       valuesObject:

operators/forgejo/application.yaml

@@ -14,7 +14,7 @@ spec:
   source:
     chart: forgejo
     repoURL: code.forgejo.org/forgejo-helm
-    targetRevision: 17.0.1
+    targetRevision: 17.1.4
     helm:
       releaseName: forgejo
       valuesObject:

operators/grafana/kustomization.yaml

@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/grafana/grafana-operator.git/deploy/kustomize/overlays/cluster_scoped?ref=v5.22.2
+  - https://github.com/grafana/grafana-operator.git/deploy/kustomize/overlays/cluster_scoped?ref=v5.24.0
 
 patches:
   # Drop resource requests/limits — single-node cluster doesn't need them.

operators/sops-secrets-operator/application.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     chart: sops-secrets-operator
     repoURL: https://isindir.github.io/sops-secrets-operator/
-    targetRevision: 0.27.1
+    targetRevision: 0.27.2
     helm:
       releaseName: sops-secrets-operator
       valuesObject:

workloads/arc/arc-tf-application.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     chart: gha-runner-scale-set
     repoURL: ghcr.io/actions/actions-runner-controller-charts
-    targetRevision: 0.13.1
+    targetRevision: 0.14.2
     helm:
       releaseName: arc-tf
       valuesObject:

workloads/warp/cloudflared.yaml

@@ -41,7 +41,7 @@ spec:
         runAsUser: 65532
       containers:
         - name: cloudflared
-          image: docker.io/cloudflare/cloudflared:2026.2.0
+          image: docker.io/cloudflare/cloudflared:2026.8.1
           securityContext:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false